Enclave disclosed AuthMask, a flaw allowing an unprivileged malicious Android app to impersonate an installed Microsoft app and obtain work-account tokens from Microsoft Authenticator. In the researchers’ tests, a device with the broker and a signed-in work account exposed mail and files without further interaction, while Microsoft’s description includes inducing an authentication flow as an attack condition. CVE-2026-80097 was fixed on September 8; the researchers identify versions before 6.2606.4246 as affected. This disclosure does not mean a new patch has just shipped. Android users can respond directly by checking and updating the app.